Squashfs maintainer patches overflow and bounds bugs in the kernel

Phillip Lougher, the Squashfs maintainer, has posted a large set of fixes for the kernel's compressed read-only filesystem after a wave of AI-generated bug reports prompted a manual review. Four of the problems were flagged by those reports. The rest he found by reading and testing the code. Together they cover arithmetic overflow, signedness mistakes, and missing checks on data read from disk, plus mount-time allocations that can grow far beyond what a typical image needs.

A crafted Squashfs image can make the kernel fail, and in several cases that failure is more than a bad mount. Lougher wrote that the faults can be used as a potential exploit. On a 32-bit kernel, an overflowing fragment count can shrink the in-memory fragment index so a later lookup reads past the allocation. Elsewhere, superblock fields can be chosen so a size check wraps and the mount path asks for a multi-megabyte allocation before the bad image is rejected. If panic-on-warn is set, a failed large allocation can take the machine down. On images with enormous inode, fragment, or extended-attribute tables, mount could try to pull as much as 32 MiB or 64 MiB into memory with the kernel's small-object allocator, which on current kernels is usually capped near 4 MiB. The fixes keep a simple lookup array for ordinary images and switch large indexes to a four-page cache.

Other holes let an attacker point an inode or directory reference outside the table that is supposed to hold it. Metadata is compressed by default, and a normal install of the Squashfs tools can already rewrite an image, so this is not a trivial remote attack. Lougher's concern is locked-down embedded and secure systems that ship only basic utilities. With echo and dd, a tampered image can replace a root directory or a file that only root should read with one that unprivileged users can open after remount.

Extended attributes were also mishandled: a count stored as a signed value can go negative above 2^31-1, so a walk of the attribute list does not stop, and a zero count was treated as success instead of corruption. File block numbers stored in a signed int overflow once a file passes 8 TiB at the usual 4 KiB page size, which can hang a read of the end of a sparse file. Block and fragment sizes that are detectably invalid were also passed down to the decompressor, burning cache and decompressor slots before the read failed.

The series widens the risky arithmetic, rejects out-of-range locations before allocating or reading, and adds a final sanity check. Lougher included reproducers for the overflow and bounds faults, including cases that make files readable by unprivileged users.